DerGrumpf/cyper-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Reorderd Secrets to match a structure

Browse Source
This commit is contained in:
DerGrumpf
2026-06-29 12:17:55 +02:00
parent a24e82bf5a
commit 73ff128705
19 changed files with 199 additions and 180 deletions
Download Patch File Download Diff File Expand all files Collapse all files
home/default.nix
+6 -6
View File
@@ -43,8 +43,8 @@
enableNixpkgsReleaseCheck = false; enableNixpkgsReleaseCheck = false;
stateVersion = "26.05"; stateVersion = "26.05";
sessionVariables = lib.mkIf (!isDarwin && !isServer) { sessionVariables = lib.mkIf (!isDarwin && !isServer) {
GROQ_API_KEY = config.sops.secrets.GROQ_API_KEY.path; GROQ_API_KEY = config.sops.secrets."api_keys/groq".path;
OPENWEATHER_API_KEY = config.sops.secrets.OPENWEATHER_API_KEY.path; OPENWEATHER_API_KEY = config.sops.secrets."api_keys/openweather".path;
}; };
file = lib.mkIf (!isServer) { file = lib.mkIf (!isServer) {
"Pictures/Avatar" = { "Pictures/Avatar" = {
@@ -67,13 +67,13 @@
else else
"/persist/secrets/age-key.txt"; "/persist/secrets/age-key.txt";
secrets = { secrets = {
GROQ_API_KEY = { }; "api_keys/groq" = { };
OPENWEATHER_API_KEY = { }; "api_keys/openweather" = { };
ssh_private_key = { "ssh/private_key" = {
path = if isDarwin then "/Users/${primaryUser}/.ssh/ssh" else "/home/${primaryUser}/.ssh/ssh"; path = if isDarwin then "/Users/${primaryUser}/.ssh/ssh" else "/home/${primaryUser}/.ssh/ssh";
mode = "0600"; mode = "0600";
}; };
ssh_github_key = { "ssh/github_key" = {
path = if isDarwin then "/Users/${primaryUser}/.ssh/github" else "/home/${primaryUser}/.ssh/github"; path = if isDarwin then "/Users/${primaryUser}/.ssh/github" else "/home/${primaryUser}/.ssh/github";
mode = "0600"; mode = "0600";
}; };
home/desktop/waybar/common.nix
+2 -2
View File
@@ -150,11 +150,11 @@
format = "{}"; format = "{}";
return-type = "json"; return-type = "json";
exec = '' exec = ''
curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}' curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en" | jq -c '{text: "\(.name) \(.main.temp)C°"}'
''; '';
interval = 120; interval = 120;
on-click = '' on-click = ''
data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/OPENWEATHER_API_KEY)&units=metric&lang=en") data=$(curl -sf --max-time 10 "https://api.openweathermap.org/data/2.5/weather?lat=52.281311&lon=10.527029&appid=$(cat ~/.config/sops-nix/secrets/api_keys/openweather)&units=metric&lang=en")
city=$(echo "$data" | jq -r '.name') city=$(echo "$data" | jq -r '.name')
temp=$(echo "$data" | jq -r '.main.temp') temp=$(echo "$data" | jq -r '.main.temp')
feels=$(echo "$data" | jq -r '.main.feels_like') feels=$(echo "$data" | jq -r '.main.feels_like')
home/neovim/avante.nix
+4 -5
View File
@@ -1,5 +1,4 @@
{ {
# Avante: AI-powered coding assistant (Cursor-like experience in Neovim)
programs.nixvim = { programs.nixvim = {
plugins = { plugins = {
markdown-preview.enable = true; markdown-preview.enable = true;
@@ -13,7 +12,7 @@
providers = { providers = {
groq = { groq = {
__inherited_from = "openai"; __inherited_from = "openai";
api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/GROQ_API_KEY"; api_key_name = "cmd:cat /home/phil/.config/sops-nix/secrets/api_keys/groq";
endpoint = "https://api.groq.com/openai/v1/"; endpoint = "https://api.groq.com/openai/v1/";
model = "qwen/qwen3-32b"; model = "qwen/qwen3-32b";
system_promt = "You are a helpful coding assistant. Always respond in plain markdown format without using tool calls or JSON structures."; system_promt = "You are a helpful coding assistant. Always respond in plain markdown format without using tool calls or JSON structures.";
@@ -29,9 +28,9 @@
ollama = { ollama = {
endpoint = "http://10.10.0.2:11434"; endpoint = "http://10.10.0.2:11434";
model = "qwen2.5:3b"; # swap for "llama3.2:3b" or "deepseek-r1:1.5b" model = "qwen2.5:3b";
timeout = 60000; # local + small model can be slow on first load timeout = 60000;
disable_tools = true; # these small models aren't reliable at tool calling disable_tools = true;
is_env_set.__raw = ''require("avante.providers.ollama").check_endpoint_alive''; is_env_set.__raw = ''require("avante.providers.ollama").check_endpoint_alive'';
extra_request_body = { extra_request_body = {
options = { options = {
hosts/cyper-controller/smb.nix
+3 -2
View File
@@ -1,11 +1,12 @@
{ {
pkgs, pkgs,
primaryUser, primaryUser,
config,
... ...
}: }:
{ {
sops.secrets.smb_passwd = { }; sops.secrets."network/smb_passwd" = { };
users.users.${primaryUser}.extraGroups = [ "sambashare" ]; users.users.${primaryUser}.extraGroups = [ "sambashare" ];
@@ -93,7 +94,7 @@
sleep 1 sleep 1
done done
PASSWORD=$(cat /run/secrets/smb_passwd) PASSWORD=$(cat ${config.sops.secrets."network/smb_passwd".path})
(echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -a -s ${primaryUser} || \ (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -a -s ${primaryUser} || \
(echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -s ${primaryUser} (echo "$PASSWORD"; echo "$PASSWORD") | ${pkgs.samba}/bin/smbpasswd -s ${primaryUser}
''; '';
hosts/cyper-desktop/hardware-configuration.nix
+2 -3
View File
@@ -34,12 +34,11 @@
}; };
sops = { sops = {
secrets.smb_passwd = { }; secrets."network/smb_passwd" = { };
templates.smb_credentials = { templates.smb_credentials = {
content = '' content = ''
username=${primaryUser} username=${primaryUser}
password=${config.sops.placeholder.smb_passwd} password=${config.sops.placeholder."network/smb_passwd"}
''; '';
}; };
}; };
nixos/default.nix
+10 -6
View File
@@ -23,10 +23,12 @@
./catppuccin.nix ./catppuccin.nix
]; ];
sops.secrets."nix_cache_priv_key" = { sops.secrets = {
"nix/cache_priv_key" = {
mode = "0400"; mode = "0400";
}; };
"nix/cachix_auth_token" = { };
};
nix = { nix = {
settings = { settings = {
@@ -48,7 +50,7 @@
"https://nix-community.cachix.org" "https://nix-community.cachix.org"
"https://cyper-cache.cachix.org" "https://cyper-cache.cachix.org"
]; ];
secret-key-files = [ config.sops.secrets."nix_cache_priv_key".path ]; secret-key-files = [ config.sops.secrets."nix/cache_priv_key".path ];
trusted-public-keys = [ trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc=" "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
@@ -113,8 +115,6 @@
}; };
}; };
sops.secrets.cachix_auth_token = { };
systemd.services.cachix-push = { systemd.services.cachix-push = {
description = "Push new store paths to Cachix"; description = "Push new store paths to Cachix";
after = [ "multi-user.target" ]; after = [ "multi-user.target" ];
@@ -122,7 +122,11 @@
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = true; RemainAfterExit = true;
ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${config.sops.secrets.cachix_auth_token.path}) ${pkgs.cachix}/bin/cachix push cyper-cache'"; ExecStart = "${pkgs.bash}/bin/bash -c 'CACHIX_AUTH_TOKEN=$(cat ${
config.sops.secrets."nix/cachix_auth_token".path
}) ${pkgs.nix}/bin/nix path-info --recursive /run/current-system | CACHIX_AUTH_TOKEN=$(cat ${
config.sops.secrets."nix/cachix_auth_token".path
}) ${pkgs.cachix}/bin/cachix push cyper-cache'";
}; };
}; };
nixos/roles/frontpage/frontpage.nix
+2 -2
View File
@@ -13,7 +13,7 @@ let
"/var/lib/flame-${name}:/app/data" "/var/lib/flame-${name}:/app/data"
] ]
++ extraVolumes; ++ extraVolumes;
environmentFiles = [ config.sops.secrets."flame_${name}_password".path ]; environmentFiles = [ config.sops.secrets."services/flame/${name}_password".path ];
}; };
instances = [ instances = [
@@ -57,7 +57,7 @@ in
]; ];
sops.secrets = lib.listToAttrs ( sops.secrets = lib.listToAttrs (
map ({ name, ... }: lib.nameValuePair "flame_${name}_password" { }) instances map ({ name, ... }: lib.nameValuePair "services/flame/${name}_password" { }) instances
); );
virtualisation = { virtualisation = {
nixos/roles/gitea.nix
+9 -10
View File
@@ -2,7 +2,6 @@
pkgs, pkgs,
lib, lib,
config, config,
primaryUser,
... ...
}: }:
@@ -20,27 +19,27 @@ let
in in
{ {
sops.secrets = { sops.secrets = {
"gitea/dbPassword" = { "services/gitea/db_password" = {
owner = "gitea"; owner = "gitea";
group = "gitea"; group = "gitea";
mode = "0444"; mode = "0444";
}; };
"gitea/internalToken" = { "services/gitea/internal_token" = {
owner = "gitea"; owner = "gitea";
group = "gitea"; group = "gitea";
}; };
"gitea/lfsJwtSecret" = { "services/gitea/lfs_jwt_secret" = {
owner = "gitea"; owner = "gitea";
group = "gitea"; group = "gitea";
}; };
"gitea/mailerPassword" = { "services/gitea/mailer_password" = {
owner = "gitea"; owner = "gitea";
group = "gitea"; group = "gitea";
}; };
"gitea/runnerToken" = { "services/gitea/runner_token" = {
mode = "0444"; mode = "0444";
}; };
"kanidm_gitea_secret" = { "kanidm/gitea_secret" = {
owner = "gitea"; owner = "gitea";
group = "gitea"; group = "gitea";
mode = "0444"; mode = "0444";
@@ -75,7 +74,7 @@ in
RemainAfterExit = true; RemainAfterExit = true;
}; };
script = '' script = ''
pass=$(cat ${config.sops.secrets."gitea/dbPassword".path}) pass=$(cat ${config.sops.secrets."services/gitea/db_password".path})
${pkgs.postgresql_14}/bin/psql -c \ ${pkgs.postgresql_14}/bin/psql -c \
"ALTER USER gitea WITH PASSWORD '$pass';" "ALTER USER gitea WITH PASSWORD '$pass';"
''; '';
@@ -126,7 +125,7 @@ in
port = 5432; port = 5432;
name = "gitea"; name = "gitea";
user = "gitea"; user = "gitea";
passwordFile = config.sops.secrets."gitea/dbPassword".path; passwordFile = config.sops.secrets."services/gitea/db_password".path;
}; };
settings = { settings = {
@@ -222,7 +221,7 @@ in
gitea-actions-runner.instances."cyper_nix" = { gitea-actions-runner.instances."cyper_nix" = {
enable = true; enable = true;
url = "https://git.cyperpunk.de"; url = "https://git.cyperpunk.de";
tokenFile = config.sops.secrets."gitea/runnerToken".path; tokenFile = config.sops.secrets."services/gitea/runner_token".path;
name = "cyper-controller"; name = "cyper-controller";
labels = [ "nix:host" ]; labels = [ "nix:host" ];
nixos/roles/matrix/coturn.nix
+3 -4
View File
@@ -1,15 +1,14 @@
{ config, lib, ... }: { config, lib, ... }:
{ {
sops.secrets = { sops.secrets = {
coturn_static_auth_secret = { "matrix/coturn_static_auth_secret" = {
owner = "turnserver"; owner = "turnserver";
group = "turnserver"; group = "turnserver";
}; };
coturn_static_auth_secret_synapse = { coturn_static_auth_secret_synapse = {
owner = "matrix-synapse"; owner = "matrix-synapse";
group = "matrix-synapse"; group = "matrix-synapse";
key = "coturn_static_auth_secret"; key = "matrix/coturn_static_auth_secret";
}; };
}; };
@@ -21,7 +20,7 @@
min-port = 49000; min-port = 49000;
max-port = 50000; max-port = 50000;
use-auth-secret = true; use-auth-secret = true;
static-auth-secret-file = config.sops.secrets.coturn_static_auth_secret.path; static-auth-secret-file = config.sops.secrets."matrix/coturn_static_auth_secret".path;
realm = "turn.cyperpunk.de"; realm = "turn.cyperpunk.de";
cert = "${config.security.acme.certs.${realm}.directory}/full.pem"; cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem"; pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
nixos/roles/matrix/discord-bridge.nix
+12 -6
View File
@@ -1,15 +1,15 @@
{ config, lib, ... }: { config, lib, ... }:
{ {
sops.secrets = { sops.secrets = {
discord_bot_token = { "matrix/bridges/discord/bot_token" = {
owner = "mautrix-discord"; owner = "mautrix-discord";
group = "mautrix-discord"; group = "mautrix-discord";
}; };
discord_client_id = { "matrix/bridges/discord/client_id" = {
owner = "mautrix-discord"; owner = "mautrix-discord";
group = "mautrix-discord"; group = "mautrix-discord";
}; };
discord_pickle_key = { "matrix/bridges/discord/pickle_key" = {
owner = "mautrix-discord"; owner = "mautrix-discord";
group = "mautrix-discord"; group = "mautrix-discord";
}; };
@@ -35,9 +35,15 @@
}; };
script = '' script = ''
mkdir -p /run/mautrix-discord mkdir -p /run/mautrix-discord
echo "DISCORD_BOT_TOKEN=$(cat ${config.sops.secrets.discord_bot_token.path})" > /run/mautrix-discord/env echo "DISCORD_BOT_TOKEN=$(cat ${
echo "DISCORD_CLIENT_ID=$(cat ${config.sops.secrets.discord_client_id.path})" >> /run/mautrix-discord/env config.sops.secrets."matrix/bridges/discord/bot_token".path
echo "DISCORD_PICKLE_KEY=$(cat ${config.sops.secrets.discord_pickle_key.path})" >> /run/mautrix-discord/env })" > /run/mautrix-discord/env
echo "DISCORD_CLIENT_ID=$(cat ${
config.sops.secrets."matrix/bridges/discord/client_id".path
})" >> /run/mautrix-discord/env
echo "DISCORD_PICKLE_KEY=$(cat ${
config.sops.secrets."matrix/bridges/discord/pickle_key".path
})" >> /run/mautrix-discord/env
chmod 600 /run/mautrix-discord/env chmod 600 /run/mautrix-discord/env
chown mautrix-discord:mautrix-discord /run/mautrix-discord/env chown mautrix-discord:mautrix-discord /run/mautrix-discord/env
''; '';
nixos/roles/matrix/draupnir.nix
+2 -2
View File
@@ -1,6 +1,6 @@
{ config, ... }: { config, ... }:
{ {
sops.secrets.draupnir_access_token = { }; sops.secrets."matrix/draupnir_access_token" = { };
environment.persistence."/persist".directories = [ environment.persistence."/persist".directories = [
{ {
@@ -13,7 +13,7 @@
services.draupnir = { services.draupnir = {
enable = true; enable = true;
secrets.accessToken = config.sops.secrets.draupnir_access_token.path; secrets.accessToken = config.sops.secrets."matrix/draupnir_access_token".path;
settings = { settings = {
homeserverUrl = "https://matrix.cyperpunk.de"; homeserverUrl = "https://matrix.cyperpunk.de";
managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de"; managementRoom = "!eErCimyDjLSebHjpJA:cyperpunk.de";
nixos/roles/matrix/livekit.nix
+7 -5
View File
@@ -1,18 +1,20 @@
{ config, ... }: { config, ... }:
{ {
sops.secrets.livekit_key_file = { }; sops.secrets."matrix/livekit_key_file" = { };
services.livekit = { services = {
livekit = {
enable = true; enable = true;
openFirewall = true; openFirewall = true;
settings.room.auto_create = false; settings.room.auto_create = false;
keyFile = config.sops.secrets.livekit_key_file.path; keyFile = config.sops.secrets."matrix/livekit_key_file".path;
}; };
services.lk-jwt-service = { lk-jwt-service = {
enable = true; enable = true;
livekitUrl = "wss://cyperpunk.de/livekit/sfu"; livekitUrl = "wss://cyperpunk.de/livekit/sfu";
keyFile = config.sops.secrets.livekit_key_file.path; keyFile = config.sops.secrets."matrix/livekit_key_file".path;
};
}; };
systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "cyperpunk.de"; systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "cyperpunk.de";
nixos/roles/matrix/meta-bridge.nix
+16 -8
View File
@@ -1,19 +1,19 @@
{ config, lib, ... }: { config, lib, ... }:
{ {
sops.secrets = { sops.secrets = {
meta_as_token = { "matrix/bridges/meta/as_token" = {
owner = "mautrix-meta-facebook"; owner = "mautrix-meta-facebook";
group = "mautrix-meta"; group = "mautrix-meta";
}; };
meta_hs_token = { "matrix/bridges/meta/hs_token" = {
owner = "mautrix-meta-facebook"; owner = "mautrix-meta-facebook";
group = "mautrix-meta"; group = "mautrix-meta";
}; };
instagram_as_token = { "matrix/bridges/instagram/as_token" = {
owner = "mautrix-meta-instagram"; owner = "mautrix-meta-instagram";
group = "mautrix-meta"; group = "mautrix-meta";
}; };
instagram_hs_token = { "matrix/bridges/instagram/hs_token" = {
owner = "mautrix-meta-instagram"; owner = "mautrix-meta-instagram";
group = "mautrix-meta"; group = "mautrix-meta";
}; };
@@ -44,8 +44,12 @@
}; };
script = '' script = ''
mkdir -p /run/mautrix-meta-facebook mkdir -p /run/mautrix-meta-facebook
echo "META_AS_TOKEN=$(cat ${config.sops.secrets.meta_as_token.path})" > /run/mautrix-meta-facebook/env echo "META_AS_TOKEN=$(cat ${
echo "META_HS_TOKEN=$(cat ${config.sops.secrets.meta_hs_token.path})" >> /run/mautrix-meta-facebook/env config.sops.secrets."matrix/bridges/meta/as_token".path
})" > /run/mautrix-meta-facebook/env
echo "META_HS_TOKEN=$(cat ${
config.sops.secrets."matrix/bridges/meta/hs_token".path
})" >> /run/mautrix-meta-facebook/env
chmod 600 /run/mautrix-meta-facebook/env chmod 600 /run/mautrix-meta-facebook/env
chown mautrix-meta-facebook:mautrix-meta /run/mautrix-meta-facebook/env chown mautrix-meta-facebook:mautrix-meta /run/mautrix-meta-facebook/env
''; '';
@@ -60,8 +64,12 @@
}; };
script = '' script = ''
mkdir -p /run/mautrix-meta-instagram mkdir -p /run/mautrix-meta-instagram
echo "INSTAGRAM_AS_TOKEN=$(cat ${config.sops.secrets.instagram_as_token.path})" > /run/mautrix-meta-instagram/env echo "INSTAGRAM_AS_TOKEN=$(cat ${
echo "INSTAGRAM_HS_TOKEN=$(cat ${config.sops.secrets.instagram_hs_token.path})" >> /run/mautrix-meta-instagram/env config.sops.secrets."matrix/bridges/instagram/as_token".path
})" > /run/mautrix-meta-instagram/env
echo "INSTAGRAM_HS_TOKEN=$(cat ${
config.sops.secrets."matrix/bridges/instagram/hs_token".path
})" >> /run/mautrix-meta-instagram/env
chmod 600 /run/mautrix-meta-instagram/env chmod 600 /run/mautrix-meta-instagram/env
chown mautrix-meta-instagram:mautrix-meta /run/mautrix-meta-instagram/env chown mautrix-meta-instagram:mautrix-meta /run/mautrix-meta-instagram/env
''; '';
nixos/roles/matrix/postgres-backup.nix
+2 -16
View File
@@ -5,7 +5,7 @@
}: }:
{ {
sops.secrets = { sops.secrets = {
pg_replication_password = { "postgres/replication_password" = {
owner = "root"; owner = "root";
group = "root"; group = "root";
}; };
@@ -17,12 +17,10 @@
description = "PostgreSQL WAL streaming replica (Docker)"; description = "PostgreSQL WAL streaming replica (Docker)";
requires = [ requires = [
"docker.service" "docker.service"
"tailscaled.service"
"network-online.target" "network-online.target"
]; ];
after = [ after = [
"docker.service" "docker.service"
"tailscaled.service"
"network-online.target" "network-online.target"
]; ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
@@ -36,14 +34,11 @@
preStart = '' preStart = ''
DATADIR="/storage/backup/postgresql-replica" DATADIR="/storage/backup/postgresql-replica"
PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path}) PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
${pkgs.docker}/bin/docker pull postgres:17 ${pkgs.docker}/bin/docker pull postgres:17
if [ ! -f "$DATADIR/PG_VERSION" ]; then if [ ! -f "$DATADIR/PG_VERSION" ]; then
echo "No data dir found — running pg_basebackup..." echo "No data dir found — running pg_basebackup..."
rm -rf "$DATADIR" rm -rf "$DATADIR"
${pkgs.docker}/bin/docker run --rm \ ${pkgs.docker}/bin/docker run --rm \
-e PGPASSWORD="$PG_PASS" \ -e PGPASSWORD="$PG_PASS" \
-v "/storage/backup:/out" \ -v "/storage/backup:/out" \
@@ -58,16 +53,10 @@
--checkpoint=fast \ --checkpoint=fast \
--progress \ --progress \
--verbose --verbose
# standby signal
touch "$DATADIR/standby.signal" touch "$DATADIR/standby.signal"
# primary conninfo
cat > "$DATADIR/postgresql.auto.conf" <<EOF cat > "$DATADIR/postgresql.auto.conf" <<EOF
primary_conninfo = 'host=10.10.0.1 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=disable' primary_conninfo = 'host=10.10.0.1 port=5432 user=replicator password=$PG_PASS application_name=cyper-controller sslmode=disable'
EOF EOF
# minimal postgresql.conf
cat > "$DATADIR/postgresql.conf" <<EOF cat > "$DATADIR/postgresql.conf" <<EOF
hot_standby = on hot_standby = on
hot_standby_feedback = on hot_standby_feedback = on
@@ -75,11 +64,8 @@
port = 5434 port = 5434
listen_addresses = '*' listen_addresses = '*'
EOF EOF
chown -R 999:999 "$DATADIR" chown -R 999:999 "$DATADIR"
fi fi
# ensure postgresql.conf exists on subsequent starts
if [ ! -f "$DATADIR/postgresql.conf" ]; then if [ ! -f "$DATADIR/postgresql.conf" ]; then
cat > "$DATADIR/postgresql.conf" <<EOF cat > "$DATADIR/postgresql.conf" <<EOF
hot_standby = on hot_standby = on
nixos/roles/matrix/synapse.nix
+9 -9
View File
@@ -34,16 +34,16 @@ let
in in
{ {
sops.secrets = { sops.secrets = {
matrix_macaroon_secret = { }; "matrix/macaroon_secret" = { };
matrix_registration_secret = { "matrix/registration_secret" = {
owner = "matrix-synapse"; owner = "matrix-synapse";
group = "matrix-synapse"; group = "matrix-synapse";
}; };
pg_replication_password = { "postgres/replication_password" = {
owner = "postgres"; owner = "postgres";
group = "postgres"; group = "postgres";
}; };
kanidm_synapse_secret = { "kanidm/synapse_secret" = {
owner = "matrix-synapse"; owner = "matrix-synapse";
group = "matrix-synapse"; group = "matrix-synapse";
}; };
@@ -95,8 +95,8 @@ in
enable_registration = false; enable_registration = false;
trusted_key_servers = [ { server_name = "matrix.org"; } ]; trusted_key_servers = [ { server_name = "matrix.org"; } ];
suppress_key_server_warning = true; suppress_key_server_warning = true;
registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path; registration_shared_secret_path = config.sops.secrets."matrix/registration_secret".path;
macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}"; macaroon_secret_key = "$__file{${config.sops.secrets."matrix/macaroon_secret".path}}";
matrix_rtc = { matrix_rtc = {
enabled = true; enabled = true;
transports = [ transports = [
@@ -162,7 +162,7 @@ in
idp_name = "Kanidm"; idp_name = "Kanidm";
issuer = "https://auth.cyperpunk.de/oauth2/openid/synapse"; issuer = "https://auth.cyperpunk.de/oauth2/openid/synapse";
client_id = "synapse"; client_id = "synapse";
client_secret_path = config.sops.secrets.kanidm_synapse_secret.path; client_secret_path = config.sops.secrets."kanidm/synapse_secret".path;
scopes = [ scopes = [
"openid" "openid"
"profile" "profile"
@@ -254,7 +254,7 @@ in
ssl = true; ssl = true;
}; };
authentication = lib.mkAfter '' authentication = lib.mkAfter ''
hostssl replication replicator 100.0.0.0/8 scram-sha-256 hostssl replication replicator 10.10.0.2/32 scram-sha-256
''; '';
}; };
@@ -273,7 +273,7 @@ in
"/var/lib/mautrix-whatsapp" "/var/lib/mautrix-whatsapp"
]; ];
postgresql.postStart = lib.mkAfter '' postgresql.postStart = lib.mkAfter ''
PG_PASS=$(cat ${config.sops.secrets.pg_replication_password.path}) PG_PASS=$(cat ${config.sops.secrets."postgres/replication_password".path})
${config.services.postgresql.package}/bin/psql -U postgres -c \ ${config.services.postgresql.package}/bin/psql -U postgres -c \
"ALTER ROLE replicator WITH PASSWORD '$PG_PASS';" "ALTER ROLE replicator WITH PASSWORD '$PG_PASS';"
''; '';
nixos/roles/monitoring.nix
+7 -7
View File
@@ -27,15 +27,15 @@ in
imports = [ ./gs-exporter.nix ]; imports = [ ./gs-exporter.nix ];
sops.secrets = { sops.secrets = {
grafana_secret_key = { "services/grafana/secret_key" = {
owner = "grafana"; owner = "grafana";
group = "grafana"; group = "grafana";
}; };
kanidm_grafana_secret = { "kanidm/grafana_secret" = {
owner = "grafana"; owner = "grafana";
group = "grafana"; group = "grafana";
}; };
zyxel_pass = { "network/zyxel_pass" = {
group = "gs1200-exporter"; group = "gs1200-exporter";
mode = "0440"; mode = "0440";
}; };
@@ -78,7 +78,7 @@ in
serve_from_sub_path = true; serve_from_sub_path = true;
}; };
security = { security = {
secret_key = "$__file{${config.sops.secrets.grafana_secret_key.path}}"; secret_key = "$__file{${config.sops.secrets."services/grafana/secret_key".path}}";
allow_embedding = true; allow_embedding = true;
cookie_samesite = "none"; cookie_samesite = "none";
cookie_secure = true; cookie_secure = true;
@@ -91,7 +91,7 @@ in
enabled = true; enabled = true;
name = "Kanidm"; name = "Kanidm";
client_id = "grafana"; client_id = "grafana";
client_secret = "$__file{${config.sops.secrets.kanidm_grafana_secret.path}}"; client_secret = "$__file{${config.sops.secrets."kanidm/grafana_secret".path}}";
scopes = "openid profile email"; scopes = "openid profile email";
auth_url = "https://auth.cyperpunk.de/ui/oauth2"; auth_url = "https://auth.cyperpunk.de/ui/oauth2";
token_url = "https://auth.cyperpunk.de/oauth2/token"; token_url = "https://auth.cyperpunk.de/oauth2/token";
@@ -181,13 +181,13 @@ in
zyxel1 = { zyxel1 = {
address = "192.168.2.3"; address = "192.168.2.3";
port = 9934; port = 9934;
passwordFile = config.sops.secrets.zyxel_pass.path; passwordFile = config.sops.secrets."network/zyxel_pass".path;
group = "gs1200-exporter"; group = "gs1200-exporter";
}; };
zyxel2 = { zyxel2 = {
address = "192.168.2.4"; address = "192.168.2.4";
port = 9935; port = 9935;
passwordFile = config.sops.secrets.zyxel_pass.path; passwordFile = config.sops.secrets."network/zyxel_pass".path;
group = "gs1200-exporter"; group = "gs1200-exporter";
}; };
}; };
nixos/roles/paperless-ngx.nix
+4 -5
View File
@@ -1,11 +1,10 @@
{ config, ... }: { config, ... }:
{ {
sops.secrets = { sops.secrets = {
paperless_admin = { "services/paperless/admin" = {
owner = "paperless"; owner = "paperless";
}; };
paperless_oidc_secret = { "services/paperless/oidc_secret" = {
owner = "paperless"; owner = "paperless";
}; };
}; };
@@ -18,7 +17,7 @@
consumptionDir = "/storage/fast/paperless/consume"; consumptionDir = "/storage/fast/paperless/consume";
dataDir = "/storage/fast/paperless"; dataDir = "/storage/fast/paperless";
configureTika = true; configureTika = true;
passwordFile = config.sops.secrets.paperless_admin.path; passwordFile = config.sops.secrets."services/paperless/admin".path;
settings = { settings = {
PAPERLESS_USE_X_FORWARDED_HOST = true; PAPERLESS_USE_X_FORWARDED_HOST = true;
PAPERLESS_USE_X_FORWARDED_PORT = true; PAPERLESS_USE_X_FORWARDED_PORT = true;
@@ -54,7 +53,7 @@
requires = [ "systemd-tmpfiles-setup.service" ]; requires = [ "systemd-tmpfiles-setup.service" ];
}; };
paperless-web = { paperless-web = {
serviceConfig.EnvironmentFiles = [ config.sops.secrets.paperless_oidc_secret.path ]; serviceConfig.EnvironmentFiles = [ config.sops.secrets."services/paperless/oidc_secret".path ];
}; };
}; };
}; };
nixos/roles/vaultwarden.nix
+3 -2
View File
@@ -8,7 +8,8 @@ let
userScss = builtins.readFile ./user.vaultwarden.scss.hbs; userScss = builtins.readFile ./user.vaultwarden.scss.hbs;
in in
{ {
sops.secrets.vaultwarden_env = {
sops.secrets."services/vaultwarden/env" = {
owner = "vaultwarden"; owner = "vaultwarden";
group = "vaultwarden"; group = "vaultwarden";
}; };
@@ -25,7 +26,7 @@ in
services.vaultwarden = { services.vaultwarden = {
enable = true; enable = true;
package = pkgs.oidcwarden; package = pkgs.oidcwarden;
environmentFile = config.sops.secrets.vaultwarden_env.path; environmentFile = config.sops.secrets."services/vaultwarden/env".path;
backupDir = "/var/local/vaultwarden/backup"; backupDir = "/var/local/vaultwarden/backup";
config = { config = {
DOMAIN = "https://vault.cyperpunk.de"; DOMAIN = "https://vault.cyperpunk.de";
secrets/secrets.yaml
+61 -45
View File
@@ -1,46 +1,62 @@
zyxel_pass: ENC[AES256_GCM,data:yEqvWjeII7Uk7w==,iv:j7Lj2HCzlPRnVlvd1c0dTd41gdJAGRi+U6jrH0Vm71U=,tag:AvcPhHJVTCubu/YD9RBivg==,type:str] ssh:
cachix_auth_token: ENC[AES256_GCM,data:nR7e2ZOA3q5DmkrqFEzINpKFEHVD5nyzc3DQ3QgD42fdyABV+r1Ela3iEcbU8SWj5JMRq8T1r7QxqcYW+VSMsT2cjQV2e4ZrpUmkX2QnhfmLqQBdJLhgNKBnu+x8QGJpQ3j7mG23atJ3BDTYBEKlI8y6wLEgpTX8GIVzHJVwfbqewTX4EfFyh3mVMtxAK9II/w==,iv:CSMcUdsqC97fmu1Po3cRrUj9h51Wv+KaUPfEToE7qVs=,tag:s1XHG2eyZYJJ5xd9CZb+Pw==,type:str] private_key: ENC[AES256_GCM,data:a7N6GC9OwOavo0NOQsOMZA2hzl8IO1tEbs97IFckukgj6nrdjw/Nr0CsdkOROYrz2VBgQNlQ95xSgQEssscuKq5sOlQMCaaEHeZ6QkRp7eBu0AMN+y1VGeAcAoXtyF41wZhkLHGTvePGGVpMtO6fOKwKd9rLMJeaR4gEHOwH2mihe3pmcHhc69hte9fVMTziHpDQqET+1tBt5mpf1b0zQqUYzLnVZB01u/TUz7FWPqaZrEnCItoBi/C+728bCW4Z/XUSpY0g1A5sAHevhFRsE93vbXWRF0AoZfwgImLMtjlLPxm7/6DG8NXnIg3PBsDZg/TP0xiNUCiewRlw413xStEqtM3zqQpTxFAGHC4zcRsrZ9bUwJf/jIzaxm8/EWrVKK1oGftkbxloWPzmZ744K9TXZvBDYW0kDAFm6Gygw4EhZUrHhTYeAWRmdzSNL7y0ybJ4hIE7sgixAFQ+Qdh1VMeh5KRgeFQVGkQIkSddwZunmEH2HUgG/BZ+KYsSAfEiQ+AtWwNzQCJ/YOoEa7JI5G9RZYvZ6v5m4s2R,iv:TKK3a3HcnBCe3TV0zYtnDKPkAfXUGRhPEcaBFkwXX1g=,tag:GyT2OjwNVBkUV+Cs59Q6mw==,type:str]
GROQ_API_KEY: ENC[AES256_GCM,data:OyuC4jfw67sCDa0XBGr78S6pzPV1ruy7KiIqPMgWWcOCVm3Y/khXEYPMjUTGrq9YLOw1MLso0OE=,iv:0y9klMYVtGsqAaLc2JidjZYSLhhbcbWbnBf8sZiC3rM=,tag:r6G2pzZn2d9JIaS+ozKnmg==,type:str] github_key: ENC[AES256_GCM,data:7/fHXvyZ4YtQPAyfgd5RK/JYW2JsvFh8XkI7SCkTLqSEFfH0aKjGQKiy2R0P0OCpsZbWNiczDI467IbGYox43fqRE6gcWZSp55yKCqlLKPkklsvXhyAlPFoionQQefRW36JMsDzq0QsdgRb3IvvKY2oPSMSZDWykNJqSPChe/h/3oujaIZ1ZjRmrDzRrsukqxdMzh/+75vFPC7OADH7q/NT248zlcmrcVTw9HlJMn9G1oz5ufmoNSHoSv/LsOpzLGWffknCiKi17ewEhatWaC6DhL9NgScMFcRHEVkAvoS6ivsXgoqQeh0t5Z80MJYUCIYnqZxu/e/TWG3tXi3EStVmN8gyoJfvmLxgjC2dzjKCClJwgrFUa7Eul5jZeSJHymG/ZVEliH+aPxscu2P3kb3TJCThCctiBr0+WNCz219fE5bt8uePm38t1HYYGcD837ExUACFFtfz772IGgSmaw0scOGBpUxo3YBz4Bki6d65MgTKf13aaV6JM/97+NB5a5REERH2lBt9lAqCWSqs8JtTNlwQq0Zfk64eduZ3qgNMfj3E=,iv:KvYUjVbvb70OVC8dTk02jjONHP1boZ3NOnfZFbhkxoo=,tag:dRNvvVY/MB75yEA/x6YrmA==,type:str]
OPENWEATHER_API_KEY: ENC[AES256_GCM,data:bcuLz70u40nZfNgPTaeNRXdR/zjx0SQjwMbMNNFqROI=,iv:VCzse1a1/k1ZDIpFPL1QhjuS6YaDyohWi61JZaoc0Ws=,tag:UJSNyniNNLfGGRY/uiJcRA==,type:str] nix:
smb_passwd: ENC[AES256_GCM,data:+9RYomcnCZSME5DzuJWTLbS3IGJHhIYWZ5SmsgOn6YQ=,iv:VRPVR7DD+swjeUZKe54XYm3wn/KB4RqvQAyYXQbS+A8=,tag:NnA89efo6HVL0scHgyTZMQ==,type:str] cache_priv_key: ENC[AES256_GCM,data:+7PvIbHb8oRb9fEWjaO9n3XxTIpkHzpB7zwRx3sYhoHsDXkYZRtan9fVIp+FUC+Uv6ZYgvZJ2SWU6W4dgajHL4W8quS/RdAwYi5F5UhAFKh/Y8faTpayOgWr8BIrNtPp17Q=,iv:JGmwCg1jaVyHowfSOaQ5KryRo9EkP3GzwMK0fkz99eM=,tag:2l3SsoIBSeiMXxCIUq9iUg==,type:str]
grafana_secret_key: ENC[AES256_GCM,data:d6tu4kL7flfbdeOYk21zkSRmVe+NvVwd14jgr9Ds0adfgYetN852G25Z8/g=,iv:uWuwGBZVK1syhEfO9nLZUWwa801759tNJx+Pmnz3xeg=,tag:X6/NcdGZHAdIlOwxNPo/Ew==,type:str] cachix_auth_token: ENC[AES256_GCM,data:SG8fiyHEepsTzts0gB4p0VR/QcOvNACkI+kBRR/Oq91D190F84eupC2an1m2OYoXEwsvprFEOkn6cstdVJj/0jmcN5vM9SFSp+NjGB9xEh4RiehBaiteXKF0MY8YT2k3NUF1H11ZdA+XE6yxmyb7r0CksPtwXsEwiKiRfPNcXPNlHQNF9mARS4nyGqeNUe2FAA==,iv:33RAKxf6mmWh4a3cKuiKFXgPqUpq0Yrpe4ug/rOzolY=,tag:jmbvNR59GGUXqbQg0hWc/g==,type:str]
kanidm_grafana_secret: ENC[AES256_GCM,data:rqK3hkpvtg24P4UVV0pFuabUhxoTgtZvK+h8EiSfVyOSrnRy6jtyGvOMMlIOAQDr,iv:I6e++KrpxAFhM8VDQkx8YsrQSvT4brc+Fh1cY5PlwKY=,tag:sEq91Yucb2pUTDbRir+NyA==,type:str] network:
matrix_macaroon_secret: ENC[AES256_GCM,data:a9nMar+p+FXIsxxSqO/to2OJOvD1erfwLwwBeKOcWBu7xykHxqD+pCmrGhg=,iv:rp4ZDVIlZ7SN1RFHB2CfSV5ISPMl9pC4U8Jgqpz48Qs=,tag:LxmWUZE3mG4acagQmlieag==,type:str] zyxel_pass: ENC[AES256_GCM,data:4ES+Hqh9q0CeBQ==,iv:UaMBQXlj7Lp1ITLwdmnxNja4948nh0S3d2SrzIZ7Fcw=,tag:NC8uUCrheyuDK7a6SX3mmQ==,type:str]
matrix_registration_secret: ENC[AES256_GCM,data:KhKkJZqwE8xk4/tuQ7NYTv/Ot1qCAiy8yUbDyVvRa0H5BT4amCBIdATfR4Q=,iv:HBN+GorT1VpWCVkDugk4UxYLEYKJIoDZh2d+oUDLc8g=,tag:hHus458yVnH0qaQ4u37IZg==,type:str] smb_passwd: ENC[AES256_GCM,data:rDJxLyjttog6lBMQtJMJrAwzqdi5d9MHa/lLmYc7Y/k=,iv:+RnqzatLGPmbuxxdXt5FEQPSAFw5vyT7FP/ljoB8OrY=,tag:yrBjjYPgfvgW1vF0uUdEpA==,type:str]
kanidm_synapse_secret: ENC[AES256_GCM,data:F770siYcYLm3RAQ+3epfVTyp5mv0OJfiOdFiHD8CudjceNkkSuXIX7pxQYkhS3VY,iv:hqYMKLS5m+o3leFE0gBS05Npjy9uyqgSe7yJpPzxvQY=,tag:lLjVZ7/iYoIZh06VyF8zSw==,type:str] wireguard:
vaultwarden_env: ENC[AES256_GCM,data:tGAphb8y+9sdo29z1/zRe4IKKKAsKfJZIiRGSDe1Vbpn24ucjnvrDpbuI8AIf145mVckCZ6nsdB88q+XNr4jrywx3b5gGdacZn/wLx6rVpa24VdJOI685nu++CtJjUiPCOiNVRza7MGFStCWTekRGosVWwwjmu8IRHEtywO/+qkVa2tFx9SGxB9ayVHWJVJNI0V3EoWgXp0Sf+gYZvMww0Ew05xeeCdICe9Tz6ExVsI/2feq2QPBgcR4M+g47UrixWf0HmR+WU/HQygSYZ0vxau+88PyfrlOUWBZY0WtETNd0pymVHnvHyFIuBjwa8zg,iv:Oytbdz/9KS21sy2tWAws2DTKTmW8IOJcSso1K1tYm3M=,tag:iWphR6xUegNrCEsqL2o0yQ==,type:str] cyper-proxy: ENC[AES256_GCM,data:46/HuqzAQUqfqOL8cbW4KGELEqaL5rJy5ih++8k1E2xWA64DxQ+fHYR9ERw=,iv:b80GAAqqQITDN476TwR5pWTwBxZZ6bdhBs+VBKRcrUk=,tag:tb1yS1fxo/eTeEWqe6yXQQ==,type:str]
flame_phil_password: ENC[AES256_GCM,data:Xy2ixMeRlnzC2gjKGrjfSbz/ee4=,iv:WFuBS8jn7WYRxEDG3XBzCMnm4eNkHQpSs5+GUwq/dcg=,tag:1zzj0eB9/4KrmYAqcxJMlg==,type:str] cyper-desktop: ENC[AES256_GCM,data:SefZogukK+BlsggykL3G741rz23wS5/7lx3F4Ckk/sqfxiFJzMbMoCIlIdE=,iv:0m2ZIU87dwtspoMkxoAKFSvu7yLwX6un7luzb1J/d+0=,tag:HrTtoN5pkdYvyNbq+9yLEw==,type:str]
flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str] cyper-controller: ENC[AES256_GCM,data:FtBLNj73V36/mXFAfWlpiejKjvEeZYaIeILVun3KLNOkhy9RHP4bTdfKc6Q=,iv:iX71amlKbMxTkF0vFZ1KNtxsdRQyD4QhHSQyYv5er80=,tag:LtXApRvoNWooFLU+df1OXA==,type:str]
paperless_admin: ENC[AES256_GCM,data:sVvlMQ3dDE2XsDfpwpCTbzPCEKdUMNTFtRXDIuBbgyf1gd6oiJzE23Ytc57plNUGg5h5aEtgxZ7NXeuK5vrhQw==,iv:x+QNAzY9k9t23UYlM9GcAke0urEA5jlV0VzHaBQkm7M=,tag:D/bMtjuwrX6pquZfJLwdkQ==,type:str] cyper-node-1: ENC[AES256_GCM,data:O7Ivb3v+FlpqUEAuQV6rYZLifKxbBWiiNhwMHeY0swrSseinFtS6vNE5BmU=,iv:LIxniCFkX1mRj0bLPsz4XLX93Mhz2NEN9NRjxKzuakY=,tag:hPp077sdjFpxFIxjXME7yQ==,type:str]
paperless_oidc_secret: ENC[AES256_GCM,data:+oCeHlky5FgUR8Toue1iQiTaqVX3ZgenEv74S5Cg6XHBObyDLUgUkZNYKj7p88nR,iv:29CBYlOjpyegGwEl5lSlAirkCWtG0+4oOupOTfeI1yM=,tag:KckKGdFa9tNwigWEukLN3w==,type:str] cyper-node-2: ENC[AES256_GCM,data:RKGrJBsfRTErZglS142uWqWofS8hlFW4y19Hddv+RV1/FTrD/pt1ATYmo0E=,iv:R4j7Cx3juTyzTeewPiPfyFzDtNySH9UH5/vZXRDM/sE=,tag:Dxfne48Mtvzi6qqgb+MpOw==,type:str]
livekit_key_file: ENC[AES256_GCM,data:wOtJhwDtZNEY+QjHyLL1FTOtkmzkNA5BoTsx0+ZMij9uUaKC28uFIkMAq2ZzIU7Nyvk8+4YjbK/Rrsoy,iv:UTDuItr0XsG+/4HFkEHDpxXy41QiVgPCisHeMMY2dQo=,tag:SkoeLWClO9I/V2sn27Y2uw==,type:str] cyper-mac: ENC[AES256_GCM,data:xutA7q3Sp72OiRqDWHToYV0kLM3h2lG4DXd3oH4sglGwMS/OS+D8Dwwuetk=,iv:Zb4LPRrWPfICOUSiVtBbdh+YqqL62wteU8DkAOXRy2s=,tag:6w1V0QhKmbyV6yjY+BXNNA==,type:str]
draupnir_access_token: ENC[AES256_GCM,data:ZZUc3a5UfjUe/6HG/EWUNAw2ND0FDNZobOwMW0uktsv8dfieZxL1Agjt,iv:bsLbGsXJfnRPScxmzdUXxgIS7QNol6HgimHBDJXivsU=,tag:P/BqC/KioVj0V+82lLNiZw==,type:str] api_keys:
coturn_static_auth_secret: ENC[AES256_GCM,data:7AI0E8Hu4WxI5q4j1GqBMSQ+evE006uPMtwIfGn4eFz+XB2JA6fhhiGMPPxSkqOyK+3eZJ5ahiG05JpmBmmAbw==,iv:hQJQQDVo43U7lvV754PC1THeFCpZZEyag+BslXyoDos=,tag:Vkm+IXr1h8ZNpah6UYaKng==,type:str] groq: ENC[AES256_GCM,data:pU+FKpJWRi2z1W7GDQbHqlVzVfS6Dd7CypGokvNcWFRU2N28vdHM1oD+DegGaxJSR0rmG2rWYjw=,iv:Ob+h75nGfda+UKAYWDaNzyxZ4v4219Rtxvih17mBd4E=,tag:1njBY8WypB2cAxWSQFxi3g==,type:str]
discord_bot_token: ENC[AES256_GCM,data:j37Qo3FCyRwNFqWSWpnQKCs+AxH5HlQ8U5If7ylHilQoORp8Pb3TtNETTJSjZyvUXllldevAbHrbAEEKnNfoUJx1U8/wl6H0,iv:WQqxFXTE+0LIB2lSvVcnr4LNXPE7uzNc0Kk8NU6Z/aE=,tag:fNeQLhoThEgfa4sSGKLZCw==,type:str] openweather: ENC[AES256_GCM,data:YTF/zgp6nBnhv3HosrgJeLYSeLObVaUpRST/k/M6C5c=,iv:AjsnpY0sneoNvr/TcQ5LkSJbmFpc1JUQ0GCYGwMt6ow=,tag:rMiwtOoLdwmHltT7Zw9Htw==,type:str]
discord_client_id: ENC[AES256_GCM,data:U/iUKXT6Nsl6LRN9lPh1xaIaqw==,iv:k7kQ8rJBrMs3YwD9aDfZ6qhd7H3aVsSPTOwEIxVTw2Y=,tag:2wKhxGbf+P+h3BYeWUSczA==,type:str] matrix:
discord_pickle_key: ENC[AES256_GCM,data:6j1pBQxmK8kFELSBBeJ0FwzAHz1GTGhxQwrvhlLtiU9+HICBBJqmFra1veZSO4yLchye/yPZ9Ha7oau+SgOI6w==,iv:YcTQQFcfLK33CpZnhEiKkt71e4ziarGKPyt7mmdQ+NA=,tag:AJRD4xYvYOZ0L1Xo+O+aGg==,type:str] macaroon_secret: ENC[AES256_GCM,data:1KuJEOEuk8UZbu2drFBqmhn42SB3NfJWeOCcbaf3jV8WIW7P3YyjVdY1j4E=,iv:3STA/kOqKZ/+ViouC7vtGAot1iwhjHGybw9lGF/Uf7Y=,tag:fHv1GQw+OS+/wLELkmB/Xw==,type:str]
meta_as_token: ENC[AES256_GCM,data:WNkfHIRl9bGdzGRgjE2C9fymA0nX/ginNqRldyygaWw=,iv:BTVB+sf46mEQ/+FXCe4SRgmkfpnO2wnWlpKr/4uQbe0=,tag:qP42MN2qm1Tn6physjLK5g==,type:str] registration_secret: ENC[AES256_GCM,data:B7kgV+atIlf+8dF25i9K0PtjVBqef3z/Ot8Zu1mwitdtBTH/ZkSotnByRxo=,iv:e9R2N0LRVMPBwPW2rCUSnoOgRhIY1nly23jVx23f+mc=,tag:2xD7F/KS2MC9n2RafcTuQw==,type:str]
meta_hs_token: ENC[AES256_GCM,data:BG7sSy0dIxf8EwjIA3rXxRZ+6IRPc2sJKSFXw+aldvY=,iv:gjk3pl/iV6rivxxrnR0jjEiSkmj0Jl5ojsudepKpxtY=,tag:n+BGaHRD+CqfXCbRPtFmfw==,type:str] livekit_key_file: ENC[AES256_GCM,data:LZjTDUtd4MTLZcqG3AhtqSKgcjnXaK5UPDa6ZKrextdBpTVbgX526+qkpIYYdbErbwHR3Ly6nIglMUqY,iv:MnVr/wWL5ef8/yqwU8eqLK8a+LV8ekgFhvpViAR5v1s=,tag:9AI4ZOX5pCqY2Ap9Gs3UJA==,type:str]
instagram_as_token: ENC[AES256_GCM,data:zKAv60IezEYqDEZNOFS5aKgNztBL9JUM9sfTZCD+vkg=,iv:3xCkVfT0S947LzpDzC0N1kuHOBhVaveK3m0cay0DlGc=,tag:NgJq8YN2r6NKj8pwlsgkXA==,type:str] coturn_static_auth_secret: ENC[AES256_GCM,data:ohYLtZxw7vV0ciFmgytslPUrPSJlKIg88U44jY2iqHzm1LocL50kR1rEDTytakpKGD4klbJoldUnv8t9fCPmcQ==,iv:p6jRjaRXwwMMpC+nBsZ85Znoyk/Skd4zP9HaeeyZ5Nk=,tag:VR0hqAURe11MMVFVy1inKQ==,type:str]
instagram_hs_token: ENC[AES256_GCM,data:+Lp9PQLUxyn/xS+L/hFcsufF0UxQJTiEd/7su8NmobI=,iv:ad9Urc8CwTfLWWRpUL6/TxfTB7LU8XoPq3kp8ifhfr0=,tag:0KkcdDAB/9rcuIgbLBZAkQ==,type:str] draupnir_access_token: ENC[AES256_GCM,data:x6om7MeVn9dbgV4w7gyOtAn5fiqgZkMVdYmas610NPSgIj1zQhOG4led,iv:3ZsVnxnNGfOmTnjAMPxknvleM4BLRkFY8oPcFZo2/Vs=,tag:DTej5tK2WKWCvXCMsnbVZw==,type:str]
pg_replication_password: ENC[AES256_GCM,data:w2h07D+j3LNkcbvoKQ2Qp3HSvC2Wf5HRAPAo/HNhmUkHBOaDyILNxo7IDjqajv0jytpG7q4joCJQhS7tEUlA9Q==,iv:26ZurAq61IDqGdAl0yPpoTJElo93hJJIEUlza4DGDNc=,tag:a46FOKgeqEEZE+rC+H9NbQ==,type:str] bridges:
kanidm_gitea_secret: ENC[AES256_GCM,data:RavtSb5BaJGwwLB/oGzG/KK2AyV+IzEjihVxnD3/dVnxmxcG+CITIYPLvFUJjmvY,iv:Cg8dAhtJXDvRGULIkpWAyuhhlLEdvN+4lyjHPR/740I=,tag:8kMGrOjXEA4GWSLlP7oIkA==,type:str] discord:
gitea: bot_token: ENC[AES256_GCM,data:5PvPk9yyh2+e+0jqPvCgh9LmdsH5SPEJvDDvVome/Di2a9S5xHwjTqy/wlEnTYIsVjkV99YvB3MIgJQ5yfY+o6ugWLA2Dn+Q,iv:ijBkSVxOHtkw9R5kcKI33oF8LrzVjNmA06HAH39qTps=,tag:Pqmv2TdSw5mZWL6li4e3tg==,type:str]
dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str] client_id: ENC[AES256_GCM,data:5+ccIw6oZJgnFCbM0qSz12ZjHg==,iv:BPuxfnNRECzLClujH7fLKGLExlnxZZZ8/8hmnykZagA=,tag:LeLabHo5VOakp95FlGI6kg==,type:str]
internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str] pickle_key: ENC[AES256_GCM,data:9MDfp6+GYqdp32Ax5+D9UrgRzftaodfAjrcAqnqM0CPF5mgMljjkipJkSyrd0hgSaTx+lhidaK2h9qo255HNxQ==,iv:eSqKbs4tS9av1mxM6A41igsMH+YcLX805YUYkCqf77A=,tag:OxUrgiO8IdUoQ3G/hgEf0w==,type:str]
lfsJwtSecret: ENC[AES256_GCM,data:L20mFZ6zwsF3ZUoodarTJV+vhUdLlBrUbHz7FpEzJ2/C6AdFc1ZZcioN3g==,iv:E2C3gg1OYQ46Ae2bGnhF+3uw+q77l+yph3Kd2fxwW9M=,tag:VQkQ4R9S8Dr39rSLhL/X1w==,type:str] meta:
mailerPassword: "" as_token: ENC[AES256_GCM,data:jJ+wsrl7ZYRDStqBdOqmkBAmrUn5jQHuKnZaTR8szzI=,iv:tcLCsDRn4W78txhtxTtegyugNX6Q+3TrC5Mufdn/gvY=,tag:tL9iSw70lVJjWO7IXUeCOg==,type:str]
runnerToken: ENC[AES256_GCM,data:giY3e3oHqWytgIWfnuKxOfrp8R+u7I0lMzEGnLWXnZWL9aQkVsM1kiF1FNKn/A==,iv:YsQrAKU8pncPeSSosOFn9BjU676KCh956FGC2hnCuac=,tag:+eZ1y6P/85XNPD9gVVNMgA==,type:str] hs_token: ENC[AES256_GCM,data:rZg+4pbo6OCQUQLfU8k8ZH1WAD/+rozsPJBXbWBSj/k=,iv:oTDcvQf27nl9WRbNUnUcTvTaB5V8yqPp5hRJ3ahGdog=,tag:OC8yjihe/1LG4BuRAcswng==,type:str]
ssh_private_key: ENC[AES256_GCM,data:R511mVFVk1ogAd5CKk/2P6rtT4NnHIFfKyqeCen545QgcvDqDFmW0rFBmPJyipaya2srJNoWvKJbnvxWtTYeJh2tPAybRMoUicStIFMUn3FPNfjx/WuQFLhKLoU3UOHHPJnkFqkQ9MBqLq2k5K7MVsNNFTxIDCKS1jPgkTmAWjRZ0EFiRXLa+Gvnz3GP5ltgfjDwdPeb5xp0/AqKPD8jea9w5ClR6ckrRHCLsfXhL2e9IaF4B96JlIv4rICLX3HmeIgM2PKl2MnSt8we5z39bBoLSA0yWG6BvpiMBaFqbo7jeHf1SxI6R404/emHhwW3pwSCDrq2ZE1ATG2UmA5NssFcVuaBPBoQer+n5haVYMNpNUp6rtKZeAIbf5JEOXJ6CJqiInfnnzOMNGhGFkGUYkhsy3p6Ti/lmNMPX/xtY+8ZqMwXf5drssm5KgnQ5nDbVqnTWAhoT/D3t+cJVAaXGTGw88fU0X95dZr8vaL/5nBCj1uUdv5cRBJ8PGhqbBX8PoiXrtGooBGhxf6nHbxIneSzG1++MZGo3e1G,iv:D1lgCnZKm3Gyv6cZpQ7zGW7JXN5RCwoaas+LroTkhPc=,tag:WI6Nr1cX8gm5pjFpu/Ok0w==,type:str] instagram:
ssh_github_key: ENC[AES256_GCM,data:vZAH4cRDsgGXLAppQKOyUPOvmBJZ27bujMGz4hQ8tt0xhGFUP28llwGZz/VRuU02Yv4alLgVWBAIPuyhZT9f35KnjIR1Mmb7HXk/6oaNM59/lBiISLrnOpC10WmJ9O5krKdxwP8ZDvHA34B0s+oYNkTNXiU0S8AVg3icploax7ylKH5Dorj53kjdYSTjd8KN6ZsgCKmcz97+GnP0IgdmauyNL7e+kv9WIfE8Xx1kGvC8WVnidX2YhSxm6vt8l60eUj9etRigU88oFYTDZ+mIf4lucSpzaLZutz2fM/16D/o9SS7mmTrEllj2S+IXc9ZZTRKKDLbW+yv0XUi0XZi+OHAdZScjS54NZKyT9uWrc/IDJHammGsoHRQpHZtbGhkeFi/KdJsYBsWItslXjM0xJVtFIM2tMnd10kv9UGuXsSl9J4NC0rpz3aXnQqG4ZAhMjN9D/DTJpB4K0pcFyd2FDWdrbKq5iPfnU/V6ecnHPML6wCt6gua/LdK1MWoG3l2SqwMLYj1r7UW5fQZqSw1EK0BAtp9cQMLBL/2w8ykMfWpLekE=,iv:gcinU7xOoXQkFVkLNB3sQYHAcZy3pZN+bDRIq4sspys=,tag:yawgAHBKIkGpnKPHsRId4g==,type:str] as_token: ENC[AES256_GCM,data:yHlEGjW1BUNP7RpPgbzlspVbEV0BKRjs5kfCaSOK/hM=,iv:rWGIoRCV53ZDrm0NCQyuxlwlpgdZ5Eh2szhWYa3hYIM=,tag:HFSekpiQ+Lic4Tn8cJOxWw==,type:str]
nix_cache_priv_key: ENC[AES256_GCM,data:FbRHM4n7BDMDgZYtTOdpS0SQx80afxMC3uw6PtdKb1zcAjyQRYwJe0esTDLklLDh8Kx6dgZOJbrf2sYIzF5xVv09U1Uz0C1UnF4M6yhbg+Nqg0HfVj55L3Z6ulrxNlgq7gY=,iv:F9DZUsyzZocKoB0yByeBcrCw9Ytcp+Xk6y8+ZH4OV7k=,tag:mSf1zVciPkifzr3kVFAt0g==,type:str] hs_token: ENC[AES256_GCM,data:7RYeehkMI8/f/c8A5xC2V4gyt9ouFOc3gNWpawNH7UI=,iv:kHPVNI3GdUicxyCwwx3724HXK4KdQC6v9BV2iFJ2du8=,tag:ftbtp/nEEdXp87WHceErjg==,type:str]
wireguard: kanidm:
cyper-proxy: ENC[AES256_GCM,data:ohe1JLavTPpEcQl+EGPcmJodBn6KaLf7S7aCLrHEgROklcX28Yjm1m4uW0Q=,iv:4iEO3ay0sqaRUxsqR3P7XFpbD6mnnq73yNsZbT22iGU=,tag:HwQaId/xi6OF99z9bZf6ew==,type:str] grafana_secret: ENC[AES256_GCM,data:qStEzFKZd+A8vKRVbi+2mRF2j7E19AwHJmYWLd7k8S3Q8rlRBy1dKETX1N6D2T/m,iv:Gbz/dIp0wUK/i01jpSJ5LDS63l3/h9L4ccF+Ie1IwHw=,tag:GawIF/czOqwlfdl2kha0zw==,type:str]
cyper-desktop: ENC[AES256_GCM,data:pABywoxw/BURnpwCfsvXD7jmN+fa6NyHmJIKpR6pkTUNHE2h1xsD64M54JE=,iv:UcDWk1ULbbxBDad/MDD94Iaj2bB/xlpLWtsuPTP6E7c=,tag:La/PWVzumCusn9IaAFkxwQ==,type:str] synapse_secret: ENC[AES256_GCM,data:JBgAv/dWDRaK/KxnxFS5RlreU1Thgmsaro6PAliYOVDb/xm0pyv/Vn0aqkXMosee,iv:GqXwP2ReZdtyYomkoCMiMWJDym/xZ3+9aMpJpM/wnOU=,tag:5AoAgkMdH1mnyFAPlJOcpw==,type:str]
cyper-controller: ENC[AES256_GCM,data:q85Tw7GGuoMlsRPDlPJ0n3aUw3cOejmjDwxSBr6Jkw+L7ZAU9yz7vthIpho=,iv:CdHhEqAOBMqsa3ZWD2RIoTlyObBpnUQhdZncmq8u7W0=,tag:tCYXugIb7rQDkgwRsY023Q==,type:str] gitea_secret: ENC[AES256_GCM,data:ATgMYYfQUreliHXiQnyBfpdRomPgUuWJroRS+qknzrHg67z/6c+8zF0ojU7t1nJY,iv:s53AiQ/6SqfNGLYGdNhuyLxYY+wzeG+vJvCbVZrstyA=,tag:AqOH2QKC2CGjFy4Iyy8x+w==,type:str]
cyper-node-1: ENC[AES256_GCM,data:+Des2tr8Fja0IarMmn6xc2bjYIlwfoVmdXMRC8yyenIrke+SS09/VV8ed/A=,iv:xL6gxjur1FNDtziNP/bEGyUXZ9VD9wmxHmWb6BR3xig=,tag:RGLuXGMAJSaREE9b9RnnfA==,type:str] services:
cyper-node-2: ENC[AES256_GCM,data:0vjNM8xgHXQtKDeKD6NBYjn3jpt9NMsLgaxZOzb9wgg1HTeLjwhK7Xw12Co=,iv:CETgdC0nKP5n8XMZj++bXWUY/harcJu+wj3S3ksLE0U=,tag:6EHF7DWi0ruKjJht1ndWcA==,type:str] grafana:
cyper-mac: ENC[AES256_GCM,data:8MSy7ALUwYyk42CpIuiym4L3VIn0MSyxr0M1Gz+t/hAwzNdvWQkYUZirZ+Q=,iv:eUbXRhhR3/ZQGJE/Uf0bISWx1YeOuPqhhMBo4CwF23w=,tag:mgfXWrEWyS3AsvlA6EJq8g==,type:str] secret_key: ENC[AES256_GCM,data:aIxWzr885wkJusnS1mBfLIG9mrqbKQh/63pQqu+cqnj7w/IHb84OmGtcgi4=,iv:aSeH6gB23KtqXKsN3YJBojUUsUERCZh7vwwu+Y40dUY=,tag:ng/nIb8qhxM8xAtLXXYEJQ==,type:str]
gitea:
db_password: ENC[AES256_GCM,data:dvnhkFXULTxzJvJwjx2sIEKxJYAanfHSBbajKlEiOjbblYqlNr8yz8k/PWs=,iv:1lPmzHe2P8V8VFZSsfXBAegaZk7esQ7fa8Jh6TzAZRM=,tag:c1zIRReEvJ05hKxS8izUNA==,type:str]
internal_token: ENC[AES256_GCM,data:/vIuj0hFsiXO68fUGuG2JvcGlpK4euZ/fr2xJgi0il4V61N2Y7ybKmjHYgHxelw7FB2zsmLgSu/7bY4S2ZMw0dg+qQbsBdc63ouOg6QMXFDXECHrEMmrXztUU27jkRAvI3GEiiP9gXSo,iv:X7VvcfV1bXw7ly76fypmfE746llrPNrGVEDW5JZkP+M=,tag:r+6zqFIRKZJ8nTfme0bdag==,type:str]
lfs_jwt_secret: ENC[AES256_GCM,data:CpsMCJSfYM/Q+lJ9igre5farr6eLO9d1ZPcwRFzEGFDVO1p2s0REYs+aig==,iv:3ywMoT8eNt2xAzumWg3e2Ju+gu62DWnfaa/cEYv09is=,tag:TLNC1cp0wBVQGkrWBHvw/g==,type:str]
mailer_password: ""
runner_token: ENC[AES256_GCM,data:mSdpjIMTI8XtlKSYziBfjZ8788CshKJjYQQin0IIkSBTauQqFkLd/i7M6XL92w==,iv:gO1Ffjx2cduQ+AdDnrAn5y3x6AVkynffGrGGfHG15ts=,tag:mHe6b+M31f3ZaKzEfpZM3g==,type:str]
vaultwarden:
env: ENC[AES256_GCM,data:UbSnqF1yDBxqIuuEO9l2wJgrVRrzHI8ddO0M2LF2q2ASUod9PYEIfKCbjjHQGjWdb5pR1OuM3j9e7MO73/1wsv10FZ9qMPgvYG/bzzy440RFs8eTMuwG4GYUCZiADhvQsF8EcoyAoAGMkDfdhxIYENaNVSUNwwuTD8Jq5jdbu2ZFBvFMrmN4tb8XY55/rPwuIoNJlE3+fmlanJcRNxND9sHUVsuHCGl8M7/VEDyJCX7Ind8jKE//91+QBw/aHAQJ3S2i1bQ4QGSLZdgKiWxds4ewdTfdCD7nHMIoNvbHYQiYaTBCB3j1jG4nGSC2OLAd,iv:EkHy13U0I7dMaZjRy3KHbiEjSGPgSgOlgutgLOtE3tQ=,tag:AlRneGte17JbHXHjET3pDw==,type:str]
paperless:
admin: ENC[AES256_GCM,data:nqSwbqc0BfSTFlWK98J33avzH+lAT2/GiD9h5l+DgAJI5pfIJ3KPdNjuLpNKzWt+PI41Yy7iOjWWbdKLDXFEGA==,iv:2WXUWqrV9hL5UcqXnJyRDENqdrSmu7Xwd7u3EeBJqWo=,tag:jobIJb3SNM1wAN+6DLNtnA==,type:str]
oidc_secret: ENC[AES256_GCM,data:n8d52WTA6BnhIuagg7kT+qMl7eyKwdXdtJFWEtD8FYgAb2dQ09GKSXnL/5bnb807,iv:k3MMXL2q9qewY0LMUjXuOB0h9GU0nCdmURIiUH0ZWYY=,tag:K0AxU+hBYAolVYeK3s1iMg==,type:str]
flame:
phil_password: ENC[AES256_GCM,data:ZommCiuOgVsgMsj3Z9mlc2Obq6I=,iv:Jnrw1ykDXtzd5i1DSBuHYv/DtuzEBTF1d6Uu7yw/u/U=,tag:FrNzcrACzwh4TdeZYqKFsQ==,type:str]
calvin_password: ENC[AES256_GCM,data:DZph6YVI3WxvyKvUGUm12btm3ss=,iv:BZUiR8Ti4IjsC7PcTtvM4H9K2BxNvCNx3Y7i3qA1EAY=,tag:P6E9bBUKtb/CuV1lTfcmEw==,type:str]
postgres:
replication_password: ENC[AES256_GCM,data:FwHkM5TYpbgjgb5qTeX0LgYIrZ2JOGINjri4VtlANai5d+687T/4Wx1EFgrwS9TC14TR5h29PfRyQmsUOt5aFw==,iv:lIWEMpq5TLa4xd0s/y88y+ror754z9x/9J4cQH+d5Aw=,tag:NXX0iFHakXgrDx9meXO9SA==,type:str]
sops: sops:
age: age:
- enc: | - enc: |
@@ -52,7 +68,7 @@ sops:
6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
recipient: age10pyhca0jy75wtqv5hrn0gf0jcam5272zx9h73a8xwwaxyfq89c0qs5dr9t recipient: age10pyhca0jy75wtqv5hrn0gf0jcam5272zx9h73a8xwwaxyfq89c0qs5dr9t
lastmodified: "2026-06-29T09:28:59Z" lastmodified: "2026-06-29T09:50:17Z"
mac: ENC[AES256_GCM,data:61grzRKB5rRaVat0sIko5B/V5+avtSEoyRwOH3jkWSgcsmVyjigIxfWSWFoMWTEkv1VmxbXA02WXZmMTqUQGsBwHD2chkUV63lTQOQql9yweRk0lLq1kUheDTuRTPwwnerA/1z1ANeUwHknvDzPF1dTisYhlRdH7p8oBRfISmp4=,iv:JxWfbEja2TLBvN/tg6Ub1pFZSJURUeSEkSHnivOGxfo=,tag:eLN5OjHarcQ9u7BYPsO4AA==,type:str] mac: ENC[AES256_GCM,data:Lf0EhcsyGIWuY3b3DWyynHcCtxOG56Qi3052DUSjHFM4pjDBzOqsy4xk1oEoI3fEAxYYVsGPrWzb4wrqNWWHH1eY10BSwgyyUimyOZuCPQ3SoX0Kr+LgInecwpzafPcDCUallLQ0FHnEyPqMb7j3CyJmRK4NbibGxhggFJONDiA=,iv:REF37EoncGdUx6IilOP6BZ4Vior5PejOkAuoU6vSabQ=,tag:KNvPfPclocJPmSVfKOOuJw==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.13.1 version: 3.13.1